mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-23 08:00:45 +00:00
Ruben Fiszel
8483700f0e
Under nsjail (untrusted), a docker job now runs against its OWN rootless podman
instance instead of the shared per-worker service, so no container it spawns can
outlive the job — even extra/detached ones the script starts.
- start_per_job_podman(): per docker+nsjail job (when container_runtime=podman),
start a rootless `podman system service` with isolated --root/--runroot under
the job dir; its unix socket is bind-mounted into the jail ({DOCKER_SOCK_MOUNT}
in run.bash.config.proto) and handed to the script as DOCKER_HOST.
- connect_docker()/handle_docker_job() take an optional per-job docker_host so
bollard talks to the per-job socket.
- PerJobPodman Drop tears the instance down on every exit path (success, error,
cancel, timeout, killpill): `podman rm -af --force` (removes ALL containers in
the instance, not just $WM_JOB_ID — conmon reparents so process-tree kill is
insufficient) + kill the service + remove the dir.
- unshare (trusted) keeps using the shared service unchanged.
Verified e2e on native rootless podman + nsjail: a job that detaches an extra
`sleep 600` container completes successfully and the extra container is killed
when the job ends (no leak). Tradeoff: per-job storage re-pulls images (no shared
cache yet); a shared read-only image store is a follow-up optimization.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise